test(postgres): raise backend/postgres coverage to 91.6%

[mastermanas805]

Summary

• Raises internal/backend/postgres statement coverage from a 18.7% baseline to 91.6%.
• Adds live (real-Postgres) + fake-clientset + httptest coverage across all four backends.

What's covered

• LocalBackend: Provision / StorageBytes / Deprovision / Regrade — happy path against a real cluster, plus connect-failure, duplicate-CREATE, CREATE USER collision, and privilege-denied terminal branches (DROP DATABASE / ALTER ROLE as a non-superuser "warden" role).
• DedicatedProvider: local-admin lifecycle + error branches, Neon-mode httptest success/bad-status/bad-json/http-error.
• K8sBackend: per-step Provision rollback (network policy → service), applyNamespace terminating-recreate + ctx-cancel, waitPodReady list-error + ctx-cancel, and initDatabase / StorageBytes / Regrade deep paths driven against a real Postgres by pointing a fake Service's ClusterIP at 127.0.0.1 and seeding the admin Secret.
• NeonBackend: httptest success + reuse-existing + http-error.
• NewBackend factory: k8s route-registry enablement (valid kubeconfig + REDIS_URL_FOR_ROUTES).

Remaining gap (8.4%)

Uncovered statements are defensive handlers not reachable without adding test seams to production code: conn.Close error logs, crypto/rand failures, http.NewRequest/json.Marshal construction wraps, the k8s real-pod-only route-registry block, and 3-minute pod-ready timeouts.

Test plan

• CUSTOMER_POSTGRES_DSN=… go test ./internal/backend/postgres -count=1 — all pass, 91.6% coverage, ~21s
• go vet ./internal/backend/postgres clean
• gofmt -l clean on all test files

🤖 Generated with Claude Code